Elon Musk can read your private chats on X: Here’s how

Elon Musk

Elon Musk is giving X (formerly Twitter) a major messaging makeover but there’s a catch you should know about. Last week, Musk announced the rollout of XChat, a new Direct Messaging feature built from scratch. It’s packed with fancy upgrades: vanishing messages, file sharing, voice and video calls, and promises of encryption. Sounds secure, right?

Well, not entirely.

While Musk claims XChat uses something called “Bitcoin-style encryption,” experts are raising eyebrows. For starters, there's no such thing. Bitcoin does use digital signatures for transactions, but it doesn’t actually encrypt data. So the term feels more like a buzzword than a real security protocol.

More worryingly, X’s support page explains that when you open a chat, a unique private-public key pair is created—but your private key is stored on X’s servers. That’s a big red flag for privacy advocates. Unlike apps like WhatsApp or Signal, where only you and the recipient can see the messages, X's setup means the platform technically can read your chats.

Adding to that, X itself admits it doesn’t yet protect users from “man-in-the-middle” attacks—a situation where someone could intercept and possibly decrypt messages without your knowledge. That includes, in theory, someone inside the company.

"XChat looks to be just another centralized platform where users have zero control over their data,” said Matthew Hodgson, CEO of secure messaging app Element.

In short, XChat might feel like an upgrade, but if privacy is a priority for you, it may not yet be the safest space to chat. Musk says a detailed whitepaper will arrive later this year—maybe that will clear things up. Until then, don’t assume your DMs are truly private.